diff --git a/pkg/agent/containerd/config.go b/pkg/agent/containerd/config.go
index 23199ee3a7..f2d4545606 100644
--- a/pkg/agent/containerd/config.go
+++ b/pkg/agent/containerd/config.go
@@ -92,8 +92,10 @@ func getHostConfigs(registry *registries.Registry, noDefaultEndpoint bool, mirro
 				logrus.Errorf("Failed to generate config for registry %s: %v", host, err)
 				continue
 			} else {
-				if host == "*" || noDefaultEndpoint {
+				if noDefaultEndpoint {
 					c.Default = nil
+				} else if host == "*" {
+					c.Default = &templates.RegistryEndpoint{URL: &url.URL{}}
 				}
 				config = *c
 			}
diff --git a/pkg/agent/containerd/config_test.go b/pkg/agent/containerd/config_test.go
index 7fc1dd8971..07a0700bbd 100644
--- a/pkg/agent/containerd/config_test.go
+++ b/pkg/agent/containerd/config_test.go
@@ -1192,6 +1192,16 @@ func Test_UnitGetHostConfigs(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "wildcard mirror endpoint - no endpoints",
+			args: args{
+				registryContent: `
+				  mirrors:
+						"*":
+				`,
+			},
+			want: HostConfigs{},
+		},
 		{
 			name: "wildcard mirror endpoint - full URL",
 			args: args{
@@ -1205,6 +1215,9 @@ func Test_UnitGetHostConfigs(t *testing.T) {
 			want: HostConfigs{
 				"_default": templates.HostConfig{
 					Program: "k3s",
+					Default: &templates.RegistryEndpoint{
+						URL: u(""),
+					},
 					Endpoints: []templates.RegistryEndpoint{
 						{
 							URL: u("https://registry.example.com/v2"),
@@ -1224,6 +1237,55 @@ func Test_UnitGetHostConfigs(t *testing.T) {
 								- https://registry.example.com/v2
 				`,
 			},
+			want: HostConfigs{
+				"_default": templates.HostConfig{
+					Program: "k3s",
+					Default: &templates.RegistryEndpoint{
+						URL: u(""),
+					},
+					Endpoints: []templates.RegistryEndpoint{
+						{
+							URL: u("https://127.0.0.1:6443/v2"),
+							Config: registries.RegistryConfig{
+								TLS: &registries.TLSConfig{
+									CAFile:   "server-ca",
+									KeyFile:  "client-key",
+									CertFile: "client-cert",
+								},
+							},
+						},
+						{
+							URL: u("https://registry.example.com/v2"),
+						},
+					},
+				},
+				"127.0.0.1:6443": templates.HostConfig{
+					Program: "k3s",
+					Default: &templates.RegistryEndpoint{
+						URL: u("https://127.0.0.1:6443/v2"),
+						Config: registries.RegistryConfig{
+							TLS: &registries.TLSConfig{
+								CAFile:   "server-ca",
+								KeyFile:  "client-key",
+								CertFile: "client-cert",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "wildcard mirror endpoint - full URL, embedded registry, no default",
+			args: args{
+				noDefaultEndpoint: true,
+				mirrorAddr:        "127.0.0.1:6443",
+				registryContent: `
+				  mirrors:
+						"*":
+							endpoint:
+								- https://registry.example.com/v2
+				`,
+			},
 			want: HostConfigs{
 				"_default": templates.HostConfig{
 					Program: "k3s",
@@ -1258,6 +1320,7 @@ func Test_UnitGetHostConfigs(t *testing.T) {
 				},
 			},
 		},
+
 		{
 			name: "wildcard config",
 			args: args{